Hello the list, I'm starting with freeradius. Authentication works fine ! But the informations I get is only the username (le login name in /etc/passwd). How do I get the Fullname ? Or others informations (like mail, home directory, ...) Is it possible ? is it a configuration of the server or a request from the client ? thanks for your help -- Ariel
Ariel VIVES wrote:
Hello the list,
I'm starting with freeradius. Authentication works fine !
But the informations I get is only the username (le login name in /etc/passwd).
How do I get the Fullname ? Or others informations (like mail, home directory, ...) Is it possible ? is it a configuration of the server or a request from the client ?
thanks for your help
Hi Ariel, Can you give us a bit more information about how you're using freeradius? From your description, it looks vaguely like you're using pam_radius to authenticate logins against a freeradius server - is that it? -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield@deakin.edu.au Website: http://www.deakin.edu.au
James Wakefield wrote:
Ariel VIVES wrote:
Hello the list,
I'm starting with freeradius. Authentication works fine !
But the informations I get is only the username (le login name in /etc/passwd).
How do I get the Fullname ? Or others informations (like mail, home directory, ...) Is it possible ? is it a configuration of the server or a request from the client ?
thanks for your help
Hi Ariel,
Can you give us a bit more information about how you're using freeradius? From your description, it looks vaguely like you're using pam_radius to authenticate logins against a freeradius server - is that it?
Hi, in fact, the authentication is done with the file /etc/shadow (NIS users but doesn't matter I think) my requests are done with a web interface (php => php-radius) to authenticate users (and this works well). Hope it's enough ... -- Ariel
Ariel VIVES wrote:
James Wakefield wrote:
Ariel VIVES wrote:
Hello the list,
I'm starting with freeradius. Authentication works fine !
But the informations I get is only the username (le login name in /etc/passwd).
How do I get the Fullname ? Or others informations (like mail, home directory, ...) Is it possible ? is it a configuration of the server or a request from the client ?
thanks for your help
Hi Ariel,
Can you give us a bit more information about how you're using freeradius? From your description, it looks vaguely like you're using pam_radius to authenticate logins against a freeradius server - is that it?
Hi,
in fact, the authentication is done with the file /etc/shadow (NIS users but doesn't matter I think)
my requests are done with a web interface (php => php-radius) to authenticate users (and this works well).
Hope it's enough ...
You're trying to use radius for something it's not really intended for. You'd be better off querying that information from a real directory service, like LDAP, or NIS, if you want it quicker and nastier. -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield@deakin.edu.au Website: http://www.deakin.edu.au
James Wakefield wrote:
Ariel VIVES wrote:
James Wakefield wrote:
Ariel VIVES wrote:
Hello the list,
I'm starting with freeradius. Authentication works fine !
But the informations I get is only the username (le login name in /etc/passwd).
How do I get the Fullname ? Or others informations (like mail, home directory, ...) Is it possible ? is it a configuration of the server or a request from the client ?
thanks for your help
Hi Ariel,
Can you give us a bit more information about how you're using freeradius? From your description, it looks vaguely like you're using pam_radius to authenticate logins against a freeradius server - is that it?
Hi,
in fact, the authentication is done with the file /etc/shadow (NIS users but doesn't matter I think)
my requests are done with a web interface (php => php-radius) to authenticate users (and this works well).
Hope it's enough ...
You're trying to use radius for something it's not really intended for. You'd be better off querying that information from a real directory service, like LDAP, or NIS, if you want it quicker and nastier.
Yes, and my accounts are under NIS. But i want to authenticate my users using freeradius. and it works... so it isn't possible to get additional informations with freeradius by using a shell script or with adding specific attribute ? -- Ariel
Ariel VIVES <avives@enpc.fr> wrote:
Yes, and my accounts are under NIS. But i want to authenticate my users using freeradius. and it works...
so it isn't possible to get additional informations with freeradius by using a shell script or with adding specific attribute ?
Does the NIS documentation say you can do that with RADIUS? No. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Alan DeKok wrote:
Ariel VIVES <avives@enpc.fr> wrote:
Yes, and my accounts are under NIS. But i want to authenticate my users using freeradius. and it works...
so it isn't possible to get additional informations with freeradius by using a shell script or with adding specific attribute ?
Does the NIS documentation say you can do that with RADIUS?
No.
Does the NIS documentation say I can't do that with RADIUS ? No. Well, with NIS I can get informations like login but also full username or home directory. My question isn't about NIS but about freeradius. So I can't tell the freeradius server to get login but alos full username ? -- Ariel
Ariel VIVES wrote:
Alan DeKok wrote:
Ariel VIVES <avives@enpc.fr> wrote:
Yes, and my accounts are under NIS. But i want to authenticate my users using freeradius. and it works...
so it isn't possible to get additional informations with freeradius by using a shell script or with adding specific attribute ? Does the NIS documentation say you can do that with RADIUS?
No.
Does the NIS documentation say I can't do that with RADIUS ?
No.
Well, with NIS I can get informations like login but also full username or home directory. My question isn't about NIS but about freeradius.
So I can't tell the freeradius server to get login but alos full username ?
Short of writing your own module to retrieve the data to send with Access-Accept, and adding attributes to the dictionary, no. RADIUS is a AAA protocol. Being a directory service is beyond its scope. PHP's NIS/YP functions are pretty easy to use, you'd be better off using those. -- James Wakefield, Unix Administrator, Information Technology Services Division Deakin University, Geelong, Victoria 3217 Australia. Phone: 03 5227 8690 International: +61 3 5227 8690 Fax: 03 5227 8866 International: +61 3 5227 8866 E-mail: james.wakefield@deakin.edu.au Website: http://www.deakin.edu.au
Ariel VIVES <avives@enpc.fr> wrote:
Does the NIS documentation say I can't do that with RADIUS ?
No.
Now you're being ridiculous. The NIS documentation doesn't say you can't use NIS to make wine, either. That doesn't mean it *does* make wine. If the NIS documentation doesn't tell you *how* to do this with RADIUS, it likely means you *can't* do it with RADIUS. Don't get mad at me... that's how computers work.
My question isn't about NIS but about freeradius.
I understand. I'm telling you your questions are based on false assumptions.
So I can't tell the freeradius server to get login but alos full username ?
You can tell FreeRADIUS to do almost anything you want. But if the RADIUS client doesn't support the functionality you need, it doesn't matter that FreeRADIUS is sending things like "full username". The NAS won't know what to do with it, and will ignore it. Don't get mad at me, this is how RADIUS works. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog
Ariel VIVES wrote:
You're trying to use radius for something it's not really intended for. You'd be better off querying that information from a real directory service, like LDAP, or NIS, if you want it quicker and nastier.
Yes, and my accounts are under NIS. But i want to authenticate my users using freeradius. and it works...
so it isn't possible to get additional informations with freeradius by using a shell script or with adding specific attribute ?
You can specify any attribute you like in the reply, and provided your client (the PHP app?) can access it, do whatever you want with it. If you have an IANA enterprise number you can do this: cat >/usr/share/freeradius/dictionary.MyOrg <<EOF VENDOR MyOrg MyOrgNumber ATTRIBUTE MyOrgFullName 1 string MyOrg ATTRIBUTE MyOrgHomeDir 2 string MyOrg EOF ...then in /etc/raddb/users: joe User-Password := "joespass" MyOrgFullName = "Joe Bloggs", MyOrgHomeDir = "/home/joe" If you don't have an IANA number, you will need to search the dictionaries for existing attributes you can use - see for example "dictionary.ntua" Does this answer your question?
participants (4)
-
Alan DeKok -
Ariel VIVES -
James Wakefield -
Phil Mayers